# Field is not renaming

**URL:** <https://discuss.elastic.co/t/field-is-not-renaming/243026>\
**Category:** Logstash\
**Created:** [July 29, 2020, 9:50am UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026 "2020-07-29T09:50:16Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [July 29, 2020, 9:50am UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026/1 "2020-07-29T09:50:16Z")

</div>

I am using winlogbeat and i want to create an index which stores user sessions info. but i am doing this step by step that is i am storing successfull login of user. Everything is going good but now i am facing some problem  
filter  
{  
if [agent][type]=="winlogbeat"  
{  
if [winlog][channel]=="Security"  
{  
if [winlog][event\_id]==4624  
{  
mutate {  
rename =\> {  
"SubjectUserSid" =\> "user\_reporter\_sid"  
"SubjectUserName" =\> "user\_reporter\_name"  
"SubjectDomainName" =\> "user\_reporter\_domain"  
"SubjectLogonId" =\> "reporter\_logon\_id"  
"TargetUserSid" =\> "user\_sid"  
"TargetUserName" =\> "user\_name"  
"TargetDomainName" =\> "user\_domain"  
"TargetLogonId" =\> "user\_logon\_id"  
"LogonType" =\> "logon\_type"  
"LogonProcessName" =\> "logon\_process\_name"  
"AuthenticationPackageName" =\> "logon\_authentication\_package\_name"  
"WorkstationName" =\> "src\_host\_name"  
"LogonGuid" =\> "user\_logon\_guid"  
"KeyLength" =\> "logon\_key\_length"  
"ProcessId" =\> "process\_id"  
"ProcessName" =\> "process\_name"  
"ImpersonationLevel" =\> "impersonation\_level"  
"RestrictedAdminMode" =\> "logon\_restricted\_admin\_mode"  
"VirtualAccount" =\> "logon\_virtual\_account"  
"ElevatedToken" =\> "logon\_elevated\_token"  
}  
}}}}}  
output {  
if [winlog][channel]=="Security" and [winlog][event\_id]==4624 {  
elasticsearch {  
hosts =\> ["[http://192.168.0.119:9200](http://192.168.0.119:9200)"]  
index =\> "session-%{+YYYY.MM.dd}"  
}  
}  
}  
The problem is the above field is not changing

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 29, 2020, 10:27am UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026/2 "2020-07-29T10:27:06Z")

</div>

It would be helpful if you formatted your configuration as a correctly indented code block (with the `</>` button) and posted an example of your data.

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [July 29, 2020, 10:51am UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026/3 "2020-07-29T10:51:08Z")

</div>

I don't know how to do it

---

<div class="post-metadata">

**Author:** ![bradley.king](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradley.king/32/64314_2.png) [@bradley.king](https://discuss.elastic.co/u/bradley.king)\
**Post date:** [July 29, 2020, 11:32am UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026/4 "2020-07-29T11:32:23Z")

</div>

Just wrap your code in back ticks `

For example

```  
THIS IS SOME CODE  
```

```auto
filter {
		if [agent][type] == "winlogbeat" {
			if [winlog][channel] == "Security" {
				if [winlog][event_id] == 4624 {
					mutate {
						rename => {
							"SubjectUserSid" => "user_reporter_sid"
							"SubjectUserName" => "user_reporter_name"
							"SubjectDomainName" => "user_reporter_domain"
							"SubjectLogonId" => "reporter_logon_id"
							"TargetUserSid" => "user_sid"
							"TargetUserName" => "user_name"
							"TargetDomainName" => "user_domain"
							"TargetLogonId" => "user_logon_id"
							"LogonType" => "logon_type"
							"LogonProcessName" => "logon_process_name"
							"AuthenticationPackageName" => "logon_authentication_package_name"
							"WorkstationName" => "src_host_name"
							"LogonGuid" => "user_logon_guid"
							"KeyLength" => "logon_key_length"
							"ProcessId" => "process_id"
							"ProcessName" => "process_name"
							"ImpersonationLevel" => "impersonation_level"
							"RestrictedAdminMode" => "logon_restricted_admin_mode"
							"VirtualAccount" => "logon_virtual_account"
							"ElevatedToken" => "logon_elevated_token"
						}
					}
				}
			}
		}
	}
		output {
		if [winlog][channel] == "Security" and [winlog][event_id] == 4624 {
			elasticsearch {
			hosts => ["http://192.168.0.119:9200"]
			index => "session-%{+YYYY.MM.dd}"
		}
	}
}

```

🙂

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [July 29, 2020, 11:51am UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026/5 "2020-07-29T11:51:04Z")

</div>

I'll remember this next time but why winlogbeat field is changing using logstash

---

<div class="post-metadata">

**Author:** ![bradley.king](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradley.king/32/64314_2.png) [@bradley.king](https://discuss.elastic.co/u/bradley.king)\
**Post date:** [July 29, 2020, 12:19pm UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026/6 "2020-07-29T12:19:43Z")

</div>

It's most likely due to your if conditions at the top not matching for some reason.

Can you provide an example log that is not being renamed so I can take look?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2020, 2:05pm UTC](https://discuss.elastic.co/t/field-is-not-renaming/243026/8 "2020-08-26T14:05:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.